ci(cosign): canonical signing workflow per ADR-041#21
Conversation
📝 WalkthroughWalkthroughA new GitHub Actions workflow is introduced that automates building, pushing, and signing Docker images to GHCR using Cosign. The workflow computes image tags, constructs the image, captures its digest, signs it with a private key, generates SBOM attestations, and verifies the signature. Changes
Sequence DiagramsequenceDiagram
participant GH as GitHub Actions
participant Docker as Docker Registry<br/>(GHCR)
participant Cosign as Cosign Tool
participant SBOM as SBOM Action
participant Verify as Verification
GH->>Docker: Build & push image<br/>(capture digest)
Docker-->>GH: Return image digest
GH->>Cosign: Install Cosign
GH->>Cosign: Sign image<br/>(private key + passphrase)
Cosign->>Docker: Store signature
GH->>SBOM: Generate SPDX JSON<br/>attestation
SBOM-->>GH: SBOM data
GH->>Cosign: Attach SBOM as<br/>Cosign attestation
Cosign->>Docker: Upload attestation
GH->>Verify: Verify signature<br/>(public key)
Verify->>Docker: Check signature validity
Verify-->>GH: Verification result
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/cosign-sign-image.yml (2)
24-27: Drop the unused OIDC permission.
id-token: writeis not used anywhere in this key-based flow, so it broadens the job's privileges without providing value. Remove it unless you are actually enabling keyless Cosign signing here.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/cosign-sign-image.yml around lines 24 - 27, The workflow permissions include an unused OIDC permission `id-token: write` which unnecessarily broadens job privileges; remove the `id-token: write` entry from the permissions block (the lines showing `permissions:` under `contents: read` / `packages: write`) so only the necessary permissions remain for the key-based Cosign signing flow.
33-68: Pin the third-party actions to immutable SHAs.This workflow is part of your signing trust chain, so moving tags like
@v4,@v5, and@v0leave you exposed to upstream tag retargeting. Pin eachuses:reference to a commit SHA before shipping.Example pinning pattern
- uses: actions/checkout@v4 + uses: actions/checkout@<commit-sha>Apply the same pattern to the other
uses:entries in this workflow.Also applies to: 82-83
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/cosign-sign-image.yml around lines 33 - 68, Update every `uses:` action reference to pin to an immutable commit SHA instead of a floating tag; specifically replace occurrences like `actions/checkout@v4`, `docker/setup-buildx-action@v3`, `docker/login-action@v3`, `docker/metadata-action@v5`, `docker/build-push-action@v5`, and `sigstore/cosign-installer@v3` with their respective `@<commit-sha>` values (and apply the same change to the additional `uses:` entries referenced at lines 82-83) so the workflow uses fixed commits rather than mutable tags.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/cosign-sign-image.yml:
- Around line 98-102: The Verify signature (smoke test) step uses a mutable gist
URL for the cosign key; update the cosign verify invocation in the "Verify
signature (smoke test)" step to use an immutable key source by either replacing
the gist URL with the gist raw URL that includes a specific commit hash (format:
https://gist.githubusercontent.com/Cramraika/c246bdb779518a588617839bfe2a75c1/raw/<commit_hash>/cosign.pub)
or vendoring the public key into the repo and referencing it locally (e.g.,
--key ./cosign.pub), then ensure the workflow downloads or checks out that
pinned key before running cosign verify.
---
Nitpick comments:
In @.github/workflows/cosign-sign-image.yml:
- Around line 24-27: The workflow permissions include an unused OIDC permission
`id-token: write` which unnecessarily broadens job privileges; remove the
`id-token: write` entry from the permissions block (the lines showing
`permissions:` under `contents: read` / `packages: write`) so only the necessary
permissions remain for the key-based Cosign signing flow.
- Around line 33-68: Update every `uses:` action reference to pin to an
immutable commit SHA instead of a floating tag; specifically replace occurrences
like `actions/checkout@v4`, `docker/setup-buildx-action@v3`,
`docker/login-action@v3`, `docker/metadata-action@v5`,
`docker/build-push-action@v5`, and `sigstore/cosign-installer@v3` with their
respective `@<commit-sha>` values (and apply the same change to the additional
`uses:` entries referenced at lines 82-83) so the workflow uses fixed commits
rather than mutable tags.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 49aed386-d9f2-4747-8a47-0ba601f493ac
📒 Files selected for processing (1)
.github/workflows/cosign-sign-image.yml
| - name: Verify signature (smoke test) | ||
| run: | | ||
| cosign verify \ | ||
| --key https://gist.githubusercontent.com/Cramraika/c246bdb779518a588617839bfe2a75c1/raw/cosign.pub \ | ||
| "ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}" |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
GitHub gist URL immutable revision pinning raw.githubusercontent.com
💡 Result:
To pin a GitHub Gist to an immutable revision using raw.githubusercontent.com URLs: The standard raw URL format for a specific revision (immutable, as it won't change even if the Gist is updated) is: https://gist.githubusercontent.com/[username]/[gist_id]/raw/[revision_hash]/[filename] - [username]: Gist owner's username - [gist_id]: The Gist ID (e.g., from https://gist.github.com/username/123abc) - [revision_hash]: Git commit SHA for that revision (found in Gist history or "Raw" button URL) - [filename]: Name of the file in the Gist For single-file Gists without specifying filename, it returns the first/default file. Example: https://gist.githubusercontent.com/atenni/5604615/raw/30d74d258442c7c65512eafab474568dd706c430/testNewGist Omitting [revision_hash] (e.g., https://gist.githubusercontent.com/[username]/[gist_id]/raw/[filename]) points to the latest version (mutable). To get the revision hash: - View Gist revisions via the clock icon or API (GET /gists/{gist_id}). - Click "Raw" on a file; the URL includes the current revision hash. - Use GitHub Gist API: https://api.github.com/gists/[gist_id] returns files with raw_url (latest) and history. Note: https://gist.github.com/.../raw redirects to the gist.githubusercontent.com equivalent. Use curl -L if needed for redirects. Updates to non-pinned URLs may take 2-5 minutes due to caching. Gists are Git repos, so revisions are Git commits; pinning the SHA ensures immutability.
Citations:
- 1: https://gist.github.com/atenni/5604615?permalink_comment_id=3150753
- 2: https://stackoverflow.com/questions/47066049/github-gist-raw-permalink-wont-update
- 3: https://stackoverflow.com/questions/12522539/github-gist-editing-without-changing-url
- 4: https://gist.github.com/atenni/5604615
- 5: https://stackoverflow.com/questions/16589511/how-do-i-get-the-raw-version-of-a-gist-from-github
- 6: https://docs.github.com/rest/gists/gists
🏁 Script executed:
# Check if the gist URL is accessible and look for gist structure
# GitHub gist URLs can be pinned to specific commits using the commit hash
# The format is: https://gist.githubusercontent.com/username/gist_id/raw/commit_hash/filename
# Let's verify the gist exists and understand its structure
curl -s -I "https://gist.githubusercontent.com/Cramraika/c246bdb779518a588617839bfe2a75c1/raw/cosign.pub" | head -20Repository: Cramraika/bulk
Length of output: 784
🏁 Script executed:
# Also check if there's documentation in the repo about this approach
find . -type f \( -name "*.md" -o -name "*.txt" -o -name "*.yml" -o -name "*.yaml" \) | head -20
ls -la .github/workflows/ | grep -i cosignRepository: Cramraika/bulk
Length of output: 542
🏁 Script executed:
cat -n .github/workflows/cosign-sign-image.yml | sed -n '95,105p'Repository: Cramraika/bulk
Length of output: 532
Pin the gist URL to an immutable revision to prevent silent signature validation changes.
The current gist URL lacks a revision hash and points to the latest version, which can be edited at any time. Use the immutable format: https://gist.githubusercontent.com/Cramraika/c246bdb779518a588617839bfe2a75c1/raw/[commit_hash]/cosign.pub (obtain the commit hash from the gist's Raw button or revision history), or vendor the public key directly in the repository.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/cosign-sign-image.yml around lines 98 - 102, The Verify
signature (smoke test) step uses a mutable gist URL for the cosign key; update
the cosign verify invocation in the "Verify signature (smoke test)" step to use
an immutable key source by either replacing the gist URL with the gist raw URL
that includes a specific commit hash (format:
https://gist.githubusercontent.com/Cramraika/c246bdb779518a588617839bfe2a75c1/raw/<commit_hash>/cosign.pub)
or vendoring the public key into the repo and referencing it locally (e.g.,
--key ./cosign.pub), then ensure the workflow downloads or checks out that
pinned key before running cosign verify.
1 participant
Summary
Adds canonical Cosign image-signing workflow per ADR-041 (Trivy + Cosign deploy gate). Distributed via PCN Session 14 Track 14-J Pattern 1 fanout from PR #50 on host_page (squash 11db81c).
Mechanism
Required secrets (already populated)
Public verification key
https://gist.githubusercontent.com/Cramraika/c246bdb779518a588617839bfe2a75c1/raw/cosign.pub
Refs
Summary by CodeRabbit